CVE-2024-10649

🗓️ 10 Feb 2025 18:50:27Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 50 Views🌐 WEB

Unauthenticated file uploads in wandb/openui can lead to denial of service and information disclosure.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2024-10649	10 Feb 202518:54	–	circl
CNNVD	OpenUI 访问控制错误漏洞	10 Feb 202500:00	–	cnnvd
Cvelist	CVE-2024-10649 Unauthenticated File Upload in wandb/openui	10 Feb 202518:50	–	cvelist
EUVD	EUVD-2025-5047	3 Oct 202520:07	–	euvd
NVD	CVE-2024-10649	10 Feb 202519:15	–	nvd
Positive Technologies	PT-2025-6081 · Unknown · Wandb/Openui	10 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-10649	12 Feb 202519:30	–	redhatcve
Vulnrichment	CVE-2024-10649 Unauthenticated File Upload in wandb/openui	10 Feb 202518:50	–	vulnrichment

[
  {
    "vendor": "wandb",
    "product": "wandb/openui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/1025793a-3c19-4148-a26e-80cd84d4822d

Parameter	Position	Path	Description	CWE
id	request body	/v1/share/{id:str}	Unauthenticated file upload to AWS S3 via /v1/share/{id:str} enables overwriting and storage issues.	CWE-306
file	request body	/v1/share/{id:str}	Unauthenticated file upload to AWS S3 via /v1/share/{id:str} enables overwriting and storage issues.	CWE-306
id	path	/v1/share/{id:str}	Unauthenticated download of JSON file from /v1/share/{id:str} may disclose sensitive data.	CWE-306

17 Jun 2026 06:56Current

6.6Medium risk

Vulners AI Score6.6

CVSS 36.1

EPSS0.00281

SSVC

CWE-306